* Vendors weigh in on security of e-mailed invoices
One of my readers, Douglas Johnson, sent me the following well-crafted essay on a new twist on e-commerce: e-mailed invoices. Because of concerns over confidentiality and the complete lack of assurance of delivery, very few businesses have been willing to entrust their precious bills to e-mail; however, this reluctance may soon disappear. Here is Johnson’s essay (with minor edits):
* * *
Millions of people pay bills using online banking services, but very few businesses send statements and invoices to customers via e-mail. By using e-mail, businesses can save on printing and mailing costs while providing customers with a convenient option and format that is easily filed and printed. Despite these benefits, e-mail statement delivery is almost nonexistent due to security regulations and the fear of costly breaches in privacy that could cost the sender millions in fines, litigation, and brand damage. However, new content-security software using digital rights management (DRM) technology will prevent such problems and increase acceptance by users.
Many businesses currently provide customers with the option of retrieving statements from a Web site. Users are justifiably worried about the security of their data on Web sites. In addition, access controls do not prevent accidental forwarding of confidential content by authorized users. Enforcing privacy policies becomes even more important under recent legislation such as a California law that requires companies to report any breach of security involving personal data.
Content security architectures, such as DRM, lock content so that security is embedded in content and thus travels with that content. DRM technology can require access to both hardware and user-account keys. Even if criminals get a stolen key, they can’t access the protected content without the authorized physical device (such as the computer) used for legitimate access. Content security also solves the problem of accidental forwarding by legitimate users: without the proper keys, the recipients can’t read the forwarded message. DRM provides additional controls for senders such as read receipts, print controls and expiration of transmitted documents.
Most people are used to receiving paper statements in their mailbox; they would expect digital statements to appear in their inbox automatically. People just don’t like having to visit a Web site and log on to get their bill. Unfortunately, e-mail isn’t very reliable and it isn’t particularly secure. Content security overcomes e-mail security issues while maintaining customer ease of use. Only an authorized user sitting at an authorized machine can access the encrypted message. Behind the scenes, a secure viewing application on the authorized computer contacts a trusted third party to validate the user credentials as well as the origin of the message. Content security also naturally preserves the integrity of statements used as receipts.
Both Microsoft and Adobe are solving the ubiquity problem by building DRM into their widespread desktop applications. Microsoft’s Rights Management Services (RMS) technology, based on XrML, will be included in all the new versions of Office 2003 and available as a plug-in to Internet Explorer. Both Microsoft and Adobe are building a partner network to help extend their respective technologies to the billing and invoicing systems that are used to create paper statements.
With the integration of third-party authentication services, this technology is going to become increasingly interesting to vendors and consumers. Expect to see the bill in the e-mail pretty soon.
* * *
Douglas Johnson is the vice president of Marketing at GigaMedia Access, which develops secure applications utilizing Microsoft’s RMS technology. Also contributing was David Freeman from RDA.
